Claims 



1. (Previously Presented) A system that facilitates mitigation of 
outgoing spam, comprising: a processor; 

a memory communicatively coupled to the processor, the memory having stored 
therein computer-executable instructions to implement the system, including: 

a detection component employed by an outgoing message server that 
detects a potential spammer in connection with at least one outgoing message sent by 
an entity, the detection of a potential spammer being based in part on a total score per 
sender assigned to the entity of the at least one outgoing message exceeding a threshold 
score indicative of a spammer; and 

an action component that upon receiving information from the detection 
component that the entity is a potential spammer initiates at least one action to mitigate 
spam from the entity, wherein the at least one action includes limiting sending of 
outgoing messages by the entity to a specified volume of outgoing messages until a 
subset of the at least one outgoing message are manually inspected by a human 
inspector and confirmed by the human inspector as not being spam. 

2. (Previously Presented) The system of claim 1, the outgoing 
message further comprising at least one of email message spam, instant message spam, 
whisper spam, or chat room spam. 

3. (Previously Presented) The system of claim 1 wherein the action 
initiated further comprises at least one of: 

shutting down a user account of the entity used to send the at least one 
outgoing message; 
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requiring at least one of a HIP challenge or a computational challenge to 
be solved by the potential spammer respectively; and 

sending the potential spammer a legal notice regarding at least one violation of 
messaging service terms. 

4. (Previously Presented) The system of claim 1, wherein the 
detection component increases the threshold score for the entity upon confirmation that 
the subset of the at least one outgoing message is not spam. 

5. (Previously Presented) The system of claim 1 5 wherein the 
detection is further based upon an outgoing message recipient count that is computed 
with each recipient of a set of recipients associated with the at least one outgoing 
message, wherein each recipient is counted only once. 

6. (Previously Presented) The system of claim 5, comprising 
keeping track per recipient an outgoing message that is most likely to be spam, wherein 
each outgoing message of the at least one outgoing message is assigned a score 
indicating the likeliness of the outgoing message being spam. 

7. (Previously Presented) The system of claim 5, comprising 
using a random function on a unique identifier for each recipient to track a subset of the 
set of recipients to estimate the outgoing message recipient count. 

8. (Previously Presented) The system of claim 1 , wherein the 
detection is further based upon message rate monitoring comprising computing the 
volume of outgoing messages over a duration of time. 

9. (Previously Presented) The system of claim 8, wherein the 
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duration of time comprises at least one of minutes, hours, days, weeks, months, or years. 

10. (Previously Presented) The system of claim 1, wherein the 
detection is further based upon message volume monitoring comprising a total volume of 
messages since activation of the entity's user account. 

11. (Original) The system of claim 1, wherein each recipient of 
an outgoing message constitutes one message. 

12. (Previously Presented) The system of claim 5, wherein the 
recipient count comprises one or more recipients listed in at least one of a to: field, a cc: 
field, orabcc: field. 

13. (Previously Presented) The system of claim 1, wherein the 
detection component processes and analyzes the outgoing messages to determine at least 
one of whether the message is likely to be spam or whether the sender is a potential 
spammer. 

14. (Previously Presented) The system of claim 1, wherein a number' 
of apparently legitimate outgoing messages is used as a bonus in the total score per 
sender to 'offset one or more other scores applied in the total score per sender, wherein the 
one or more other scores are based upon one or more other indications of spam. 

15. (Original) The system of claim 14, wherein the number of 
apparently legitimate messages is estimated with a spam filter. 

16. (Previously Presented) The system of claim 14, wherein the 
bonus from the number of apparently legitimate messages is limited. 



Serial No.: 10/601,159 

Atty Docket No.: MS1-4203US 

Atiy/Agent: Jacob P. Rohwer 



tee@hay£5 The Business of IP* 



17. (Previously Presented) The system of claim 1, wherein the total 
score per sender is based upon a number of non-deliverable messages of the at least one 
outgoing message. 

18. (Original) The system of claim 1 ? wherein the number of 
non-deliverable messages is estimated at least in part from Non Delivery Receipts. 

19. (Original) The system of claim 18, wherein validity of the 
Non Delivery Receipts is checked. 

20. (Original) The system of claim 19, wherein validity of the 
Non Delivery Receipts is checked against a list of recipients of messages from the sender. 

21. (Original) The system of claim 20, wherein the list of 
recipients is a sample and the penalty of a Non Delivery Receipt is correspondingly 
increased. 

22. (Previously Presented) The system of claim 1 5 wherein the 
detection component computes one or more scores assigned to each of the at least one 
outgoing message to determine the total score per sender. 

23. (Previously Presented) The system of claim 22, wherein the 
threshold score is adjustable per sender. 

24. (Previously Presented) The system of claim 1, wherein spam 
filtering comprises employing a filter trained to recognize at least one of non-spam like 
features or spam-like features in outgoing messages. 

25. (Original) The system of claim 1, wherein spam filtering is 
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performed with a machine learning approach. 



26. (Original) The system of claim 1 5 wherein spam filtering 
comprises assigning a probability per outgoing message to indicate a likelihood that the 
message is any one of more spam-like or less spam-like. 

27. (Previously Presented) The system of claim 1, further comprising a 
scoring component that operates in connection with at least one of spam filtering, total 
recipient count, unique recipient count, message volume monitoring or message rate 
monitoring. 

28. (Previously Presented) The system of claim 27, wherein the scoring 
component assigns the total score per sender based at least in part upon at least one of 
volume of outgoing messages, rate of outgoing messages, recipient count, or message 
content. 

29. (Previously Presented) The system of claim 27, wherein the scoring 
component at least one of assigns or adds a constant value to one or more outgoing 
messages to mitigate spammers from manipulating spam filtering systems. 

30. (Original) The system of claim 27, wherein the scoring 
component assigns a selected value to outgoing messages identified as having at least one 
spam-like feature. 

31. (Original) The system of claim 30, wherein the at least one 
spam-like feature is a URL. 

32. (Original) The system of claim 30, wherein the at least one 
spam-like feature comprises contact information. 
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33. (Previously Presented) The system of claim 32, wherein the contact 
information comprises a telephone number, the telephone number comprising at least one 
of an area code or a prefix to identify a geographic location associated with the message 
to thereby facilitate identifying the potential spammer. 

34. (Original) The system of claim 1, further comprising a user- 
based message generator component that generates outgoing messages addressed to one 
or more recipients based in part upon sender preferences. 

35. (Currently Amended) A method that facilitates mitigation of 
outgoing spam comprising: 

employing a processor executing computer executable instructions to perform the 
following acts: 

detectin g, via an outgoing message server comprising at least one 
hardware component, a potential spammer in connection with at least one outgoing 
message sent by an entity from a user account of a s e nd e r , the detection of a potential 
spammer being based in part on a total score per sender assigned to the entity of the at 
least one outgoing message exceeding a threshold score indicative of a spammera4-4east 
on e of numb e r of appar e ntly legitimat e outgoing m e ssages sent from th e user account 
or number of non deliverabl e m e ssag e s sent from the user account ; 

receiving information from [[the]] a detection component that the entity 
s e nd e r is a potential spammer; and 

initiating at least one action that facilitates any one of confirming that th e 
send e r is a spammer, mitigating spamming by th e s e nd e r from the entity, wherein the at 
least one action includes limiting sending of outgoing messages by the entity to a 
specified volume of outgoing messages until a subset of the at least one outgoing 
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message are manually inspected by a human inspector as not being spam or incr e asing 
cost to th e send e r . 



36. (Previously Presented) The method of claim 35, wherein the at 
least one outgoing message further comprises at least one of mail message spam, instant 
message spam, whisper spam, and chat room spam: 

37. (Previously Presented) The method of claim 35, further 
comprising monitoring outgoing messages per sender with respect to at least one of a 
volume of outgoing messages, a volume of recipients, or a rate of outgoing messages. 

38. (Currently Amended) The method of claim 35, wherein 
detecting a potential spammer further comprises: 

performing at least two of the following: 

assigning a score per outgoing message based at least in part upon content 
of the message, 

assigning a score per sender based at least in part upon outgoing message 
volume per sender, 

assigning a score per sender based at least in part upon outgoing message 
rate per sender, 

assigning a score per sender based at least in part upon a total recipient 
count per sender, 

or assigning a score per sender based at least in part upon a unique recipient 
count per sender; 

computing [[a]] the total score per sender further based upon two or more of the 
score per outgoing message, the score, per sender based at least in part upon outgoing 
message volume per sender, the score per sender based at least in part upon outgoing 
message rate per sender, the score per sender based at least in part upon a total recipient 
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count per sender, or the score per sender based at least in part upon a unique recipient 
count per sender; and 

determining whether the sender is a potential spammer based at least in part upon 
the total score associated with the sender. 

39. (Canceled) 

40. (Original) The method of claim 35, further comprising 
tracking one or more recipients and associated outgoing messages addressed to the 
recipients to facilitate identifying one or more most spam-like messages received per 
sender. 

41. (Currently Amended) The method of claim 40, further comprising 
assigning one or more scores to the one or more most spam-like messages and 
aggregating the scores per sender to compute [[a]] the total score per sender. 

42. (Currently Amended) The method of claim 35, wherein the at least 
one action comprises terminating [[the]] a sender account. 

43. (Original) The method of claim 42, wherein the sender account is 
terminated when there is substantial certainty that the outgoing messages sent by a sender 
are spam. 

44. (Currently Amended) The method of claim 43, wherein 
substantial certainty that the outgoing messages are spam is determined in part by at least 
one of the following: 

at least a portion of the outgoing message comprises at least one of an exact 
match and a near match to known spam; or 
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at least a portion of the outgoing message comprises a phrase that a human has 
determined to be spam-likef 

a probability assigned by a spam filtering filt e r e xceeds at l e ast one thr e shold 

l e v e l; or 

a — message — sent — for — human — inspection — is — determined — te — be — spam . 

45. (Currently Amended) The method of claim 35, wherein the at 
least one action comprises temporarily suspending outgoing message delivery from 
[[the]] a sender account. 

46. (Currently Amended) The method of claim 35 5 wherein the at 
least one action comprises requiring [[the]] a sender account to resolve one or more 
challenges. 

47. (Currently Amended) The method of claim 44, wherein the 
[[user]] sender account is limited to a specified number of recipients or outgoing 
messages per challenge until a specified maximum number of challenges are solved, and 
after the specified maximum number of challenges are solved then the account is limited 
to a specified sending rate of a number of outgoing messages per time period. 

48. (Previously Presented) The method of claim 45, wherein the rate 
limit may be increased by solving additional challenges. 

49. (Original) The method of claim 46, wherein the one or more 
challenges comprise a computational challenge or a human interactive proof. 

50. (Original) The method of claim 46, wherein the one or more 
challenges are delivered as a pop up message. 
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51. (Original) The method of claim 46, wherein the one or more 
challenges are delivered to the sender account via a message format similar to the 
sender's outgoing messages. 

52. (Original) The method of claim 46, wherein the one or more 

* 

challenges are delivered to the sender account in response to feedback from a server that 
a shutdown of the account is approaching. 

53. (Currently Amended) The method of claim 35, wherein the at 
least one action comprises sending a legal notice to the sender that the sender is in 
violation of terms of service and suspending an_[[the]] account of the sender. 

54. (Previously Presented) The method of claim 53, further comprising 
requiring the sender to respond to the legal notice acknowledging that the sender has read 
the legal notice prior to removing the suspension of the account via at least one of 
providing an electronic signature or clicking on a link. 

55. (Original) The method of claim 53, wherein the legal notice 
is delivered via a pop-up message. 

56. (Original) The method of claim 35, wherein delivery of 
outgoing messages is temporarily suspended until a response to the action is received. 

57. (Original) The method of claim 35, wherein a minimum 
number of outgoing messages are permitted for delivery before a response to the action is 
received. 

58. (Original) The method of claim 35, further comprising 
estimating a total volume of recipients per sender to facilitate identifying a potential 
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spammer. 



59. (Original) The method of claim 58, wherein estimating a 
total volume of distinct recipients per sender comprises: 

computing a hash function per recipient to obtain a hash value per recipient; 
setting a hash modulo value; and 

adding the recipient to a list for message tracking when the recipient's hash value 
equals the hash modulo value to facilitate estimating a total volume of distinct 
recipients per sender. 

60. (Currently Amended) The method of claim 59, further 
comprising: 

tracking worst-scoring messages each listed recipient receives per sender; 

computing [[a]] the total score per sender of substantially all listed recipients' 
scores per sender; 

and comparing the total score per sender with a threshold level associated 
with the sender to determine whether the sender is a potential spammer. 

61-70. (Canceled) 

e 

71. (Currently Amended) A computer-readable storage medium 

having stored thereon the following computer executable components: 

a detection component employed by an outgoing message server that 
detects a potential spammer in connection with at least one outgoing message sent 
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from an entity account , the detection of a potential spammer being based on a total 
score per sender assigned to the entity of the at least one outgoing message exceeding 
a threshold score indicative of a spamme rt ho outgoing m e ssag e comprising at l e ast on e 
of e mail m e ssag e spam, instant m e ssag e spam, whisp e r spam, or chat room spam, th e 
detection component limits the account to a specified number of recipients or outgoing 
m e ssag e s p e r chall e ng e until a sp e cifi e d maximum numb e r of chall e nges ar e solv e d, 
and aft e r the sp e cified maximum number of chall e ng e s ar e solved th e n the account is 
limit e d to a sp e cified sending rate of a number of outgoing m e ssages per tim e period, 
wh e r e in th e chall e nge is at l e ast on e of a human interactive proof or computational 
chall e ng e; and 

an action component that upon receiving information from the detection 
component that the entity is a potential spammer[[,]] initiates at least one action that 
facilitat e s any one of confirming that the e ntity is a spamm e r, mitigating spamming by 
the entity, wherein the at least one action includes limiting sending of outgoing 
messages by the entity to a specified volume of outgoing messages until a subset of 
the at least one outgoing message are manually inspected by a human inspector and 
confirmed by the human inspector as not being spam incroasing spammer cost, or a 
combination th e r e of , 

72. (Canceled) 

73. (Currently Amended) A system that facilitates spam detection 
comprising: 

a processor; 

a memory communicatively coupled to the processor, the memory having -stored 
therein computer-executable instructions to implement the system, including: 

a means employed by an outgoing message server for detecting a potential 
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spammer in connection with at least one outgoing message [[send]] sent from an account 
of an entity, the detection of a potential spammer being based on a total score per sender 
assigned to the entity of the at least one outgoing message exceeding a threshold score 
indicative of a spamme r thc outgoing m e ssag e comprising at least on e of c mail m e ssag e 
spam, instant message s pam, whisper spam, and chat room spam , 

a means for receiving information from [[the]] a detection component that the 
entity is a potential spammer; and 

a means for initiating at least one action that facilitates mitigating spamming by 
the entity, wherein the at least one action includes limiting sending of outgoing messages 
by the entity to a specified volume of outgoing messages until a subset of the at least one 
outgoing message are manually inspected by a human inspector and conf irmed by the 
human inspector as not being spam sonding a l e gal notice to an owner of the account 
informing the own e r that tho account is in violation of at least on e term of service of th e 
account . 

subsequent outgoing m e ssages until the on e or mor e challeng e s are 
resolv e d. 

74-75. (Canceled) 
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